From db3b399a8d7dabf7f073db73894bee98311d7909 Mon Sep 17 00:00:00 2001 From: Peter Hunt~ Date: Mon, 22 Aug 2022 15:10:05 -0400 Subject: [PATCH] server: add container GID to additional groups Signed-off-by: Peter Hunt~ --- server/container_create.go | 5 +++-- test/ctr.bats | 12 ++++++++++++ 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/server/container_create.go b/server/container_create.go index 1acfa182133..80867de29fc 100644 --- a/server/container_create.go +++ b/server/container_create.go @@ -249,10 +249,11 @@ func setupContainerUser(ctx context.Context, specgen *generate.Generator, rootfs } specgen.SetProcessUID(uid) - specgen.SetProcessGID(gid) if sc.RunAsGroup != nil { - specgen.SetProcessGID(uint32(sc.RunAsGroup.Value)) + gid = uint32(sc.RunAsGroup.Value) } + specgen.SetProcessGID(gid) + specgen.AddProcessAdditionalGid(gid) for _, group := range addGroups { specgen.AddProcessAdditionalGid(group) diff --git a/test/ctr.bats b/test/ctr.bats index 82fed4f883f..801f26c55db 100644 --- a/test/ctr.bats +++ b/test/ctr.bats @@ -885,6 +885,18 @@ function check_oci_annotation() { crictl exec --sync "$ctr_id" grep "CapEff:\s0000000000000000" /proc/1/status } +@test "ctr has gid in supplimental groups" { + start_crio + + jq ' .linux.security_context.run_as_user.value = 1000 + | .linux.security_context.run_as_group.value = 1000' \ + "$TESTDATA"/container_redis.json > "$newconfig" + + ctr_id=$(crictl run "$newconfig" "$TESTDATA"/sandbox_config.json) + + crictl exec --sync "$ctr_id" grep Groups:.1000 /proc/1/status +} + @test "ctr with low memory configured should not be created" { start_crio pod_id=$(crictl runp "$TESTDATA"/sandbox_config.json)